AND-14996 Fix script injection in build_webrtc workflow (GVMT-878)#9
Merged
manasprasher-eco merged 4 commits intoJun 25, 2026
Merged
Conversation
GVMT-878: ${{ inputs.* }} interpolation directly into shell run:
blocks allowed RCE on the runner. Pass branch_number / milestone
through env: and reference as quoted shell variables so the values
are treated as strings, not code.
GVMT-878 hardening: assert branch_number and milestone are numeric before any clone/build/release runs. Defense in depth on top of the env-var fix.
GVMT-878 hardening: declare minimum permissions at workflow level. The release step needs contents:write; everything else defaults to none. Limits damage if a future injection leaks the token.
GVMT-878 hardening: replace mutable tag refs with immutable SHAs to prevent tag-hijack supply-chain attacks. Versions in trailing comments for readability and Dependabot.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
andrewlinington
approved these changes
Jun 23, 2026
StanGomes
approved these changes
Jun 23, 2026
Contributor
Author
|
Waiting on the actual reporter to review this PR |
Contributor
Author
|
Got confirmation from the reporter that the fix works |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes GVMT-878 (CVSS 8.8) —
workflow_dispatchinputs (`branch_number`, `milestone`) were interpolated directly into shell `run:` blocks via `${{ }}`, allowing RCE on the runner for anyone with `actions: write`.Sites flagged in the H1 report: L49, L54, L63–L64.
43783c9) and step-output pattern for downstream sinks (239fa47includes the fixup).239fa47) running first; `with:` parameters now consume validated step outputs, not raw inputs.2a35281).49141ee).Verified with two
workflow_dispatchruns against this branch:branch_number="5790; echo PWNED") → fails atValidate inputsin 5s (run).branch_number=7632, milestone=145) → all touched steps green in 1h5m, release steps correctly skipped on feature branch (run).